Microsoft Agent Framework for Python 1.16

Apply the Python 3 baseline first. These rules cover Microsoft Agent Framework for Python 1.16 agents, functions, middleware, threads, workflows, checkpoints, human approval, observability, and deployment.

Agent and client configuration

• Construct agents, model clients, instructions, service endpoints, and execution settings from trusted configuration.
• Keep user text, retrieved content, memory, and tool results distinct from authoritative instructions.
• Allowlist model deployments and capabilities and bound tokens, turns, time, retries, parallelism, and spend.
• Set FunctionInvocationConfiguration(max_iterations=..., max_consecutive_errors_per_request=..., terminate_on_unknown_calls=True) with iteration and error budgets below their defaults of 40 and 3; unknown-call termination defaults to False. Leave include_detailed_errors=False so tool failures do not expose internals to the model.
• Give each agent a distinct least-privilege identity and only the functions required for its role.
• Validate AgentResponse.text/value, streamed AgentResponseUpdate content, and surfaced function or MCP results against the destination's schema, size, allowed values, and authorization before rendering or active use. Buffer bounded streams when validation needs a complete result; response_format parses shape but does not authorize actions or sanitize sinks.
• Render generated text as plain text by default. When HTML or Markdown markup is needed, encode text for its exact HTML body, HTML attribute, or Markdown context, or sanitize allowed rich markup; neutralize text